Searches initiate when users perform activities, such as:
Run a search in the interface.
For more information, see Section 5.1, Running an Event Search.
Generate a report or drill down into report results.
For more information, see Section 6.0, Reporting.
Search events with specific tags.
For more information, see Section 8.0, Configuring Tags
Search events from specific event sources.
For more information, see Section 4.4, Configuring Data Collection for Other Event Sources.
Searches that retrieve a large number of results, cover a large time range, or access networked storage can be resource-intensive; therefore running concurrent searches can slow down the system performance.
Sentinel Log Manager allows you to set the maximum number of searches you can run simultaneously to maintain stable performance. Sentinel Log Manager queues up searches that are initiated beyond the set limit. When both searches and reports are in queue, searches process first. If there are reports in queue for more than 1 hour, such reports process first. For information about the search performance, see Search and Reports Performance
in the Sentinel Log Manager 1.2.2 Installation Guide.
To configure the number of simultaneous searches:
Log in to the Sentinel Log Manager server with a user account that is a member of the administrator role.
Click > .
Specify the maximum number of simultaneous searches that you want Sentinel Log Manager to run.
Click .